Join the discussion on Telegram
Why this matters
The POST /v1/streams controller (createStream in backend/src/controllers/stream.controller.ts) destructures req.body directly and passes the values straight into prisma.stream.upsert with no validation. A createStreamSchema already exists in backend/src/validators/stream.validator.ts but is never imported or used anywhere. As a result, the endpoint will:
- throw an unhandled error and return 500 when
depositedAmount/ratePerSecond are missing or non-numeric (BigInt(undefined) / parseInt(NaN)),
- divide by zero in
endTime computation when ratePerSecond is "0",
- accept malformed Stellar addresses for
sender/recipient.
Wiring the existing validator gives clean 400 responses and removes the dead code.
Acceptance criteria
Files to touch
backend/src/controllers/stream.controller.ts
backend/src/validators/stream.validator.ts
backend/tests/integration/streams.test.ts
Out of scope
- Changing the on-chain create flow (this endpoint only registers/mirrors metadata).
Join the discussion on Telegram
Why this matters
The
POST /v1/streamscontroller (createStreaminbackend/src/controllers/stream.controller.ts) destructuresreq.bodydirectly and passes the values straight intoprisma.stream.upsertwith no validation. AcreateStreamSchemaalready exists inbackend/src/validators/stream.validator.tsbut is never imported or used anywhere. As a result, the endpoint will:depositedAmount/ratePerSecondare missing or non-numeric (BigInt(undefined)/parseInt(NaN)),endTimecomputation whenratePerSecondis"0",sender/recipient.Wiring the existing validator gives clean 400 responses and removes the dead code.
Acceptance criteria
createStreamSchema(or zodsafeParse) at the top ofcreateStreamand return400witherror.issueson failure.sender/recipientare valid Stellar public keys (a Stellar address validator already exists in the stream validators per issue Add input validation for Stellar addresses in stream endpoints #379).ratePerSecond === '0'before theendTimedivision.backend/tests/integration/streams.test.ts).Files to touch
backend/src/controllers/stream.controller.tsbackend/src/validators/stream.validator.tsbackend/tests/integration/streams.test.tsOut of scope